typewriter/docs/v0.9-robustness.md

v0.9 — Robustness

Part of the Typoena macro plan. Requirements and targets: qfd.md. Load-bearing decisions: adr.md.

Status: not started.

• Crash-safe writes (write to .tmp, fsync, rename) — NB FatFS f_rename refuses to overwrite, so it's unlink-then-rename + *.tmp boot-recovery (found in Spike 3, still open there)
• Recover from interrupted push (re-attempt on next save) — the splice journal + stranded-commit recovery (2026-07-13) already survive a power-pull mid-push; this item is the retry half
• Reconnect-on-stale-connection in the libgit2 http/stream layer — the push keep-alive race is avoided, not fixed (repack keeps the marking phase at ~3.5 s ≪ the ~30 s idle window; a multi-pack or cold-cache state could still lose it — see the real-repo-sync kaizen)
• :gl recovers from a divergence by rebasing — instead of refusing (the v0.7 ff-only behavior), the pull replants the device's local commit(s) onto origin's tip (rebase_local_onto: splice the merge_base..HEAD paths from the card onto origin's tree, last-writer-wins per note, no content merge) and ends LocalAhead for :gp to publish. The branch ref moves last, after the merged tree is applied to the card, so a power-pull mid-rebase leaves HEAD at the old tip and the next :gl recomputes the identical commit idempotently. Snackbar rebased <oid> - :gp to publish. Core done 2026-07-14 (git_sync.rs, full build green); on-device verification pending — needs a real divergence to reproduce (a stranded local commit plus a foreign push to the same branch)
• Eradicate the paint-during-sync DMA allocation failure: persistent internal DMA scratch in Epd (safety net + allocation-free repaints shipped; see the editor-freeze postmortem)
• SD card removal / reinsert handling
• Wi-Fi reconnect with backoff
• On-device provisioning + settings screen: SSID, PAT rotation, default remote, commit author (replaces the v0.1 dev-only NVS-flashing path — first release usable by someone who is not the firmware author)